directory traversal is now functional on the target client